Skip to content

Lucas Freitas

Full Stack Developer — Backend (PHP / Laravel)

PHP, Laravel and Vue.js on multi-tenant e-commerce SaaS platforms. Queues, automated testing, observability and application security.

Resume as PDFGitHubLinkedIn
stack
PHP, Laravel, Vue.js, RabbitMQ, Redis, Docker
focus
queues and jobs, automated testing, observability, application security
scale
thousands of merchants · ~20k recurring subscriptions
location
Itapema, Brazil — remote

Work

  1. LWSA — Tray, Bling and Bagy now

    Multi-tenant e-commerce SaaS, thousands of merchants.

    Technical ownership of 4 production modules: bulk promotions, AI integration, per-platform feedback and the new menu. Legacy migration, RabbitMQ queues, observability on New Relic, Graylog, Grafana and Elastic APM. White-box analysis and remediation of vulnerabilities — OWASP Top 10, IDOR, Broken Access Control.

  2. Petiko

    Subscription e-commerce, around 20k active subscriptions.

    Subscription core and checkout, carrying most of the revenue. I integrated 3 payment gateways — Pagar.me, E-Rede and MaxiPago — and 3 ERPs: Magento 2, Bling and Omie.

  3. Domestilar

    Internal management system.

    Customer service, Python dashboards and Java desktop apps.

Decisions

The suite ran twice

Two core merchant-admin projects, at roughly 10% coverage. Every release was a bet, and the pipeline took twice as long as it needed to.

The second full run of the suite existed only to merge the coverage report. Instead of speeding the tests up, I made each parallel job persist its partial report and merged them at the end.

50 minutes less per pipeline run, and coverage from 10% to 92% across both projects.

The suite ran twice

before

The jobs already ran in parallel. The whole suite ran again, from scratch, only to merge the coverage report.

after

Each parallel job writes its partial report. At the end, only the merge.

Requests timing out

Flows that ran end to end inside the request, on a multi-tenant platform. The more data a merchant had, the closer to the limit — and some were already failing in production.

Raising the timeout would only push the problem forward. I moved the processing out of the request and onto a queue, with RabbitMQ and Laravel jobs: the request answers immediately and the work happens outside it, with its own retry.

Timeouts gone on the migrated flows. The cost I took on: the answer is no longer immediate, and the caller has to track the state.

Requests timing out

before

Bulk promotions processed every product inside the request. With enough products it ran out of time and the merchant got an error.

after

The request answers immediately and queues the work. A RabbitMQ worker handles it outside, and the screen says it is still processing.

Three flaws in one checkout

The checkout of a subscription e-commerce. White-box analysis turned up three flaws open at once: account takeover, payment confirmation accepted without server-side validation, and stored XSS.

I ordered them by how far each one got an attacker, not by how easy each was to fix. The account first, because everything else follows from it. Then the payment, moving confirmation to the server instead of trusting what the client sent back. The XSS last: it reaches whoever opens the page.

All three closed. Payment confirmation now happens where the client cannot reach it.

Three flaws in one checkout

before

Three points in the flow accepted input from outside: the account session, the payment confirmation and a field reflected on the page.

after

Closed in order of how far each one reached: the account first, then the payment, the XSS last.

Code

What I write outside work.

  • pure-php-rest-api

    PSR-11 dependency injection container with Reflection-based autowiring, custom router, service layer and repositories. No framework, to understand what a framework does.

    PHP 8.3, PHPUnit, Docker

  • mercurius-js

    Webhook worker with exponential backoff, retry limits and a dead-letter queue. The same asynchronous delivery problem I solve with RabbitMQ at work.

    TypeScript, BullMQ, Redis

  • laravel-multitenancy

    One database per tenant, created and migrated on user signup. Isolation by database, not by a tenant_id column.

    Laravel 11, TALL Stack

  • project-amaterasu

    Offensive security agent with local RAG. Knowledge base indexed in ChromaDB and tools behind a fail-closed scope gate: outside the declared target, nothing runs. Phases resume from the last saved state.

    Python, ChromaDB, MCP, Docker private repository

  • quest-leveling

    Gamified productivity app. Domain split into services and DTOs, Vue 3 front end with Inertia, and LLM task classification behind its own interface — the provider is swappable.

    Laravel 11, Vue 3, Inertia, PostgreSQL private repository